For example, we have multiple logs that share the same structure:
Order Created { ..."trace": { "order_id":123456, ... }}
Order Paid { ..."trace": { "order_id":123456, ... }}
Order Voided { ..."trace": { "order_id":123456, ... }}
We can aggregate these logs using log explorer on @trace.order_id.
However, we also need to set a condition between the @timestamp of the order creation log and, for example, the @timestamp of the order voiding log.
For example:
If it's < 30s -> send an alert.
